clang  9.0.0svn
ReturnUndefChecker.cpp
Go to the documentation of this file.
1 //== ReturnUndefChecker.cpp -------------------------------------*- C++ -*--==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines ReturnUndefChecker, which is a path-sensitive
10 // check which looks for undefined or garbage values being returned to the
11 // caller.
12 //
13 //===----------------------------------------------------------------------===//
14 
21 
22 using namespace clang;
23 using namespace ento;
24 
25 namespace {
26 class ReturnUndefChecker : public Checker< check::PreStmt<ReturnStmt> > {
27  mutable std::unique_ptr<BuiltinBug> BT_Undef;
28  mutable std::unique_ptr<BuiltinBug> BT_NullReference;
29 
30  void emitUndef(CheckerContext &C, const Expr *RetE) const;
31  void checkReference(CheckerContext &C, const Expr *RetE,
32  DefinedOrUnknownSVal RetVal) const;
33 public:
34  void checkPreStmt(const ReturnStmt *RS, CheckerContext &C) const;
35 };
36 }
37 
38 void ReturnUndefChecker::checkPreStmt(const ReturnStmt *RS,
39  CheckerContext &C) const {
40  const Expr *RetE = RS->getRetValue();
41  if (!RetE)
42  return;
43  SVal RetVal = C.getSVal(RetE);
44 
45  const StackFrameContext *SFC = C.getStackFrame();
47 
48  if (RetVal.isUndef()) {
49  // "return;" is modeled to evaluate to an UndefinedVal. Allow UndefinedVal
50  // to be returned in functions returning void to support this pattern:
51  // void foo() {
52  // return;
53  // }
54  // void test() {
55  // return foo();
56  // }
57  if (!RT.isNull() && RT->isVoidType())
58  return;
59 
60  // Not all blocks have explicitly-specified return types; if the return type
61  // is not available, but the return value expression has 'void' type, assume
62  // Sema already checked it.
63  if (RT.isNull() && isa<BlockDecl>(SFC->getDecl()) &&
64  RetE->getType()->isVoidType())
65  return;
66 
67  emitUndef(C, RetE);
68  return;
69  }
70 
71  if (RT.isNull())
72  return;
73 
74  if (RT->isReferenceType()) {
75  checkReference(C, RetE, RetVal.castAs<DefinedOrUnknownSVal>());
76  return;
77  }
78 }
79 
80 static void emitBug(CheckerContext &C, BuiltinBug &BT, const Expr *RetE,
81  const Expr *TrackingE = nullptr) {
82  ExplodedNode *N = C.generateErrorNode();
83  if (!N)
84  return;
85 
86  auto Report = llvm::make_unique<BugReport>(BT, BT.getDescription(), N);
87 
88  Report->addRange(RetE->getSourceRange());
89  bugreporter::trackExpressionValue(N, TrackingE ? TrackingE : RetE, *Report);
90 
91  C.emitReport(std::move(Report));
92 }
93 
94 void ReturnUndefChecker::emitUndef(CheckerContext &C, const Expr *RetE) const {
95  if (!BT_Undef)
96  BT_Undef.reset(
97  new BuiltinBug(this, "Garbage return value",
98  "Undefined or garbage value returned to caller"));
99  emitBug(C, *BT_Undef, RetE);
100 }
101 
102 void ReturnUndefChecker::checkReference(CheckerContext &C, const Expr *RetE,
103  DefinedOrUnknownSVal RetVal) const {
104  ProgramStateRef StNonNull, StNull;
105  std::tie(StNonNull, StNull) = C.getState()->assume(RetVal);
106 
107  if (StNonNull) {
108  // Going forward, assume the location is non-null.
109  C.addTransition(StNonNull);
110  return;
111  }
112 
113  // The return value is known to be null. Emit a bug report.
114  if (!BT_NullReference)
115  BT_NullReference.reset(new BuiltinBug(this, "Returning null reference"));
116 
117  emitBug(C, *BT_NullReference, RetE, bugreporter::getDerefExpr(RetE));
118 }
119 
120 void ento::registerReturnUndefChecker(CheckerManager &mgr) {
121  mgr.registerChecker<ReturnUndefChecker>();
122 }
123 
124 bool ento::shouldRegisterReturnUndefChecker(const LangOptions &LO) {
125  return true;
126 }
A (possibly-)qualified type.
Definition: Type.h:634
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
static void emitBug(CheckerContext &C, BuiltinBug &BT, const Expr *RetE, const Expr *TrackingE=nullptr)
bool isReferenceType() const
Definition: Type.h:6313
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:49
This represents one expression.
Definition: Expr.h:108
QualType getType() const
Definition: Expr.h:130
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:2462
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:699
Expr * getRetValue()
Definition: Stmt.h:2495
Dataflow Directional Tag Classes.
const Decl * getDecl() const
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
Definition: CallEvent.cpp:459
const StackFrameContext * getStackFrame() const
bool isVoidType() const
Definition: Type.h:6553
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:251